Bug 265272

Summary: Integer calculation error after JIT optimization.
Product: WebKit Reporter: anbu1024
Component: JavaScriptCoreAssignee: David Degazio <d_degazio>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: bfulgham, darin, d_degazio, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: Linux   

anbu1024
Reported 2023-11-22 18:44:59 PST
JSC version: 5a5dc5a5c26808fa98392aecc83d38935b72d255 Build options: ``` ./Tools/Scripts/build-jsc --jsc-only --debug ``` test case: ``` function opt(){ var x = -19278.05 >>> String; var y = x + -19278.05; var z = y >> String; return z; } let a = opt(); print("result before JIT opt") print(a); for(let i=0; i<0x200; i++){ opt(); } let b = opt(); print("result after JIT opt") print(b); ``` Result: ``` result before JIT opt -38557 result after JIT opt -38556 ```
Attachments
Radar WebKit Bug Importer
Comment 1 2023-11-22 18:45:09 PST
David Degazio
Comment 2 2023-12-13 14:56:07 PST
Yusuke Suzuki
Comment 3 2025-05-23 17:27:15 PDT
We fixed this via bug 257949
Yusuke Suzuki
Comment 4 2025-05-23 17:27:20 PDT
*** This bug has been marked as a duplicate of bug 257949 ***
Note You need to log in before you can comment on or make changes to this bug.